…ecache (koala73#140)

## Summary
- prevent cloud fallback for local-only sidecar endpoints
(`/api/local-*`) in desktop runtime fetch patch
- ensure local secret/config routes never send payloads to remote hosts
on local errors
- add runtime E2E regression proving no remote fallback for:
  - `/api/local-env-update`
  - `/api/local-validate-secret`
- apply deploy/cache guardrail fixes so SPA HTML is network-driven (not
precached)
  - remove `index.html` from Workbox precache glob
  - explicitly disable `navigateFallback` (`navigateFallback: null`)
  - add deploy guardrail test coverage for `navigateFallback: null`

## Why
- Desktop secret-management routes can carry API keys and credentials;
they must remain local-only even when local calls fail.
- Precaching HTML can serve stale shell documents after deploy and point
users at deleted chunk hashes.

## Changes
- `src/services/runtime.ts`
  - classify `/api/local-*` as local-only
  - block cloud fallback for local-only routes on both:
    - non-OK local responses
    - local fetch/network errors
- `e2e/runtime-fetch.spec.ts`
- add test: `runtime fetch patch never sends local-only endpoints to
cloud`
- `vite.config.ts`
  - remove `index.html` from Workbox precache `globPatterns`
- set `navigateFallback: null` to prevent default SW navigation fallback
route generation
- `tests/deploy-config.test.mjs`
  - assert precache glob remains HTML-free
  - assert `navigateFallback: null` and no `navigateFallbackDenylist`

## Validation
- `npm run typecheck` ✅
- `npm run test:e2e:runtime` ✅ (6/6)
- `npm run test:sidecar` ✅
- `npm run test:data` ✅
- `npm run build` ✅

…#4351)

Resolves all 3 critical Dependabot alerts without changing runtime behavior:

- shell-quote 1.8.3 -> 1.8.4 (root + pro-test) via overrides. It is a
  transitive peer dep of the dead react-devtools-core/react-native tree;
  the bump is a security patch with no runtime impact. (#140, #141,
  GHSA-w7jw-789q-3m8p)
- vitest ^2.1.2 -> ^3.2.6 (consumer-prices-core), a dev-only test tool.
  All 54 tests pass and `tsc` builds clean under v3; zero production
  dependencies changed and no CI job runs it. (#139, GHSA-5xrq-8626-4rwp)

Also folded in, since it was the sole remaining blocker keeping the
security-audit gate red on every PR:

- undici 7.24.5 -> 7.28.0 (scripts), an in-range (^7.x) direct-dep patch
  for the SOCKS5 ProxyAgent TLS bypass (GHSA-vmh5-mc38-953g, high).

Removed the now-obsolete GHSA-w7jw-789q-3m8p baseline entries from
audit-production-dependencies.mjs (shell-quote is patched, not deferred)
and re-pointed the two baseline tests at advisories that are still
baselined. Full audit matrix passes exit=0 across all 6 workspaces;
lockfiles are idempotent (npm ci-safe).

Claude-Session: https://claude.ai/code/session_01JWozy1k6rwrf6ENB3XSJDR